dropper.ragger

P

pastrana

New member
this is a thread or not?? because spybot 1.4 show it like a threat but when i have repaired it appears again and i don´t know if is malicious. Thanks for your help
 
It would probably be helpful if you posted the actual log of the scan results you are questioning.

To produce and post the log:
  • Run another scan.
  • When the scan completes, right click on the results list, select "Copy results to clipboard".
  • Then paste those results (Ctrl+V) to a new post in this thread.
 
Same problem

md usa spybot fan said:
It would probably be helpful if you posted the actual log of the scan results you are questioning.

To produce and post the log:
  • Run another scan.
  • When the scan completes, right click on the results list, select "Copy results to clipboard".
  • Then paste those results (Ctrl+V) to a new post in this thread.
Click to expand...

Microsoft.WindowsSecurityCenter.UpdateDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify!=dword:0

Dropper.ragger: <$DIR_TEMP> (Directory, nothing done)
C:\Documents and Settings\Matthew\Local Settings\Temp\IXP000.TMP\

Microsoft.WindowsSecurityCenter.FirewallDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0


--- Spybot - Search && Destroy version: 1.3 ---
2004-05-12 Includes\Cookies.sbi
2006-12-08 Includes\Dialer.sbi
2006-11-24 Includes\Hijackers.sbi
2006-10-27 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2006-12-08 Includes\Malware.sbi
2006-10-20 Includes\PUPS.sbi
2004-05-12 Includes\Revision.sbi
2006-12-08 Includes\Security.sbi
2006-10-13 Includes\Spybots.sbi
2004-05-12 Includes\Tracks.uti
2006-12-08 Includes\Trojans.sbi

Dropper.Ragger will not remove from my computer as well. I can't find anything referencing it in the registry and I have tried removing it manually but no luck. Its definatly reinstalling itself from somewhere else but I can't find it. Please Help.

EDIT: Also I forgot to mention that I run my anti-virus and anti-spyware in safe mode. :EDIT
 
Last edited:
hi,

in your case the "Dropper.ragger" appears to be a false positive, please install Spybot S&D 1.4. And when updating detections please also install the sbis with C, like spybotsC.sbi , malwareC.sbi and so on, these include the most recent detection updates.

these 2 entries,
Microsoft.WindowsSecurityCenter.UpdateDisableNotify
Microsoft.WindowsSecurityCenter.FirewallDisableNotify
only inform you that the named notifications are disabled, this is usually done by other security software, for instance if you have installed a personal firewall.

If "Windows Security Center.UpdateDisableNotify" , if this is found, the Security Center does not notify about updates.

In most cases you can set these 2 can be set to be ignored from further searches.
 
This dropper.ragger make me realy angry!!

Is there any way to remove the dropper.ragger from my system????
I have instaled every updates, every files, but the f.....g dropper.ragger always come back!!
:banghead: :banghead: :banghead: :banghead:
 
Hello.

It would be helpful if we saw the top of the log as md usa spybot fan posted above:
  • Run another scan.
  • When the scan completes, right click on the results list, select "Copy results to clipboard".
  • Then paste those results (Ctrl+V) to a new post in this thread.
Click to expand...

However if your computer is showing signs of actual infection, then do the following.

Run the Spybot-S&D and on-line anti virus scan (separately) as shown here:
"BEFORE you POST" -Preliminary Steps

Start your own thread in the Malware Removal Forum

Once you have posted a helper would advise you as soon as available.

Cheers.
 
dropper.ragger removal



I just acquired this spyware last Friday while visiting wifelovers.com. Spybot Tea Timer alerted me to the Registry change, but failed to block it. Running spybot did not remove it.

I have found through past experience that the quickest and surest way to remove spyware is to boot up in Safe Mode; search the Registry for the name of the spyware and then delete it manually. Sometimes the spyware "hides" in some other file and is not easily identified via a Registry search, in which case I use the Search function (in Safe Mode) to find files modified / created on or about the date the infection was acquired and manually delete it. Sometimes it will take several tries to finally get it right.

Spybot is a great tool and provides excellent protection, but sometimes the hackers will slip one past the goalie.
 
Having the same problem.I have spybot 1.5 and i have done all the available updates.Please help me.Is this a real threat or a false alarm?Any help would be greatly appreciated.Here are my spybot scan results

Dropper.ragger: [SBI $67C2C795] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0


--- Spybot - Search & Destroy version: 1.5 (build: 20070830) ---

2007-08-31 blindman.exe (1.0.0.6)
2007-08-31 SDMain.exe (1.0.0.4)
2007-08-31 SDUpdate.exe (1.0.6.4)
2007-08-31 SDWinSec.exe (1.0.0.8)
2007-08-31 SpybotSD.exe (1.5.1.15)
2007-08-31 TeaTimer.exe (1.5.0.9)
2007-09-12 unins000.exe (51.46.0.0)
2007-08-31 Update.exe (1.4.0.5)
2007-08-31 advcheck.dll (1.5.3.0)
2007-04-02 aports.dll (2.1.0.0)
2007-04-02 DelZip179.dll (1.79.5.3)
2007-08-31 SDHelper.dll (1.5.0.8)
2007-08-31 Tools.dll (2.1.2.0)
2007-09-12 Includes\Cookies.sbi (*)
2007-07-25 Includes\Dialer.sbi (*)
2007-09-12 Includes\DialerC.sbi (*)
2007-08-29 Includes\Hijackers.sbi (*)
2007-09-12 Includes\HijackersC.sbi (*)
2007-07-25 Includes\Keyloggers.sbi (*)
2007-09-12 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-09-12 Includes\Malware.sbi (*)
2007-09-12 Includes\MalwareC.sbi (*)
2007-09-05 Includes\PUPS.sbi (*)
2007-09-12 Includes\PUPSC.sbi (*)
2007-09-12 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-09-12 Includes\SecurityC.sbi (*)
2007-09-12 Includes\Spybots.sbi (*)
2007-09-12 Includes\SpybotsC.sbi (*)
2007-08-21 Includes\Tracks.uti
2007-09-12 Includes\Trojans.sbi (*)
2007-09-12 Includes\TrojansC.sbi (*)
2008-12-24 Plugins\TCPIPAddress.dll
 
Bill_Slayer said:
... Unfortunately,after the reboot it still informs me that a registry entry has been denied.
Click to expand...
What is "it"in "... it still informs ..."?

If "it" is TeaTimer than you may have added the change to that registry entry to "Blocked registry changes" by using the "Remember this decision" on some previous change to that registry entry. If you checked "Remember this decision" on a change, the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" changes. To edit this information:
  • Right click on the TeaTimer system tray icon and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
    • Allowed registry changes
    • Blocked registry changes
    • Allowed processes
    • Blocked processes
    You can review all the entries that you have stored by clicking on these buttons. The entries that you should review are in " Blocked registry changes".
 
Spybot SD Resident informs me...we are talking about the same thing
So what should I do/review to fix the problem?
 
Last edited:
You must remove the entry from "Blocked registry changes" that is causing the registry change to be denied. You can delete entries by clicking on the scripted black "X" to the right of the entry that you want to delete, answering "Yes" to the confirmation dialog and then clicking the "OK" button when you're done.
 
I rebooted my pc and here is the result:
my.php
Now what should I choose?:oops:
 
Hey man thanks a lot!I also searched another forum and someone said that wextract_cleanup0 is a microsoft cleanup tool running because of an error during the installation of a program or something happened with windows update.Anyway I chose allow and now spybot didn't find dropper.dragger.thanks again especially to you and spybotsandra;);)
 
You must log in or register to reply here.
Back
Top